Spyware removal Forums

Bagshanty

Whilst assisting a colleague at work to remove some particularly resilient malware, I came across this site, with some excellent tools and a brilliant web tutorial.

http://www.microsoft.com/technet/sysinternals/Processesandthreadsutilities.mspx

Process Explorer is like Task Manager on steroids. Autoruns gives the most comprehensive list of autoruns anywhere, and numerous other tools.

If you follow the Process Explorer link, towards the bottom is a link to a video of a live presentation given by someone who really knows his subject, - detecting and removing malware. Systinternals used to be an independent site but is now part of MS Technet. You will need to view the video in IE - it doesn't like Firefox.

You do need to register with Windows Live ID, a slightly convoluted process, but worth the effort.

Finally, I understand how rootkits work.

twooks

oh my god - microsoft!!!! aaarrrggghhhh

try checking these guys out:

Bagshanty

1. Sysinternals.com was an independent site until 12 months or so ago

2. MS probably knows better than anyone else how Windows works (indeed, that is the EU complaint, that they do not pass that info out)

3. when the standard removal tools don't work, and you need to open the bonnet and get your hands dirty, this is the toolkit you need.

... but if you really hate MS the you must be using a Mac or Linux?

geraldandannie · Moderator

I had a quick shufty at the site Twooks posted. I downloaded Blacklight from

Bagshanty

for free anti root kit scan, see

geraldandannie · Moderator

Rapide561

Hi

We had Sophos at work and that along with the other systems in place, used to block e mails containing words such as peacock etc etc

I will leave it to you.

Russell

Bagshanty

Writing as our company's security manager (next 54 days only!), who administers both the Sophos AV solution and the email monitoring solution, (Mimesweeper), I can assure you that Sophos does not content check, except against virus signatures. (And Sophos signatures are always published significantly faster than their competitors, sometimes 24 hours ahead of Norton, in my experience).

Neither does Mimesweeper block on words like peacock or Scunthorpe. I have done extensive trials on this in the past, and I'm convinced it is an urban myth. What is useful is the ability to block all executable attachments. This has blocked many viruses for which signatures are not yet available, and I employ a similar defence at home.

However, my shipmate on the Sirius, ex chief stoker Bill Cock, does have email problems from time to time.

Bagshanty